Shopsy AS engages selected subprocessors to deliver Onebase. All subprocessors are bound by a Data Processing Agreement under GDPR Article 28, and transfers outside the EEA rely on SCCs or the EU–US Data Privacy Framework.
This is the public list of subprocessors. Version 2026.08.17.
Active Subprocessors
| Provider | Role | Data | Region | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting and databases | All data stored in Onebase including account info, CRM records and attachments | EU (Nürnberg, Tyskland) | Within EEA |
| Postmark (ActiveCampaign, LLC) | Transactional email (outbound) | Email addresses and email content in outbound email (OTP codes, notifications, invitations, quote and form links). Onebase no longer receives inbound email | USA | EU–US Data Privacy Framework (Art. 45) |
| Anthropic, PBC | AI: help assistant + optional bring-your-own-Claude (MCP/API) | Help assistant: the product question, the help-article index, locale, the workspace's name/country/currency — plus files the user chooses to attach. The assistant has no access to records and pulls nothing on its own. Bring-your-own-Claude (MCP/API): business/HR data the tenant asks its own connected Claude to fetch | USA | SCCs (Art. 46) |
| Stripe Payments Europe, Ltd. | Payments and subscription management | Tenant ID, billing address, card data (stored directly by Stripe) | Irland (EU) + USA | EU–US Data Privacy Framework (Art. 45) |
About the AI row
Both AI surfaces reach the same subprocessor, but they do not send the same thing. The help assistant has no access to your records — the only way business data reaches Anthropic through it is a file you attach yourself. Bring-your-own-Claude is optional, must be connected actively, and fetches the records you ask for. Neither surface runs with zero data retention at Anthropic. Conversations and attachments are stored in Onebase until you delete them, and are deleted automatically after 24 months without activity either way. Full walkthrough: AI & your data.
EEA-only Processing on Request
Hosting and databases already sit in the EEA, but some subprocessors (Postmark, Anthropic, Stripe Inc.) transfer data to the United States under the EU–US Data Privacy Framework or SCCs. If you require all personal data to be processed within the EEA — because of sector regulations, procurement requirements or internal policy — email post@shopsy.no. We can offer an EEA-only configuration (no AI assistant, EEA-based email provider) for customers who need it.
Change Notifications
We notify customers at least 30 days before adding a new subprocessor or relocating an existing one.
If a customer has a reasonable objection to a new subprocessor, the contract may be terminated under the agreement. See the Data Processing Agreement for details.
Other Recipients
We do not share personal data with third parties for commercial purposes. We may disclose data to public authorities where legally required, and notify affected customers as soon as the law permits.
Questions
Email questions about the list to post@shopsy.no.